flyteorg/flyte

[V2] Secret value is showing in pod spec ENVVAR directly

開放

#7,824 建立於 2026年8月11日

 (2 則留言) (0 個反應) (1 位負責人)Python (378 個分叉)batch import
flyte2good first issuehelp wanted

倉庫指標

星標
 (3,705 顆星)
PR 合併指標
 (平均合併 3天 8小時) (30 天內合併 114 個 PR)

描述

Issue

When injecting a secret into task pod like this:

env = flyte.TaskEnvironment(
    name="hello_world",
    resources=flyte.Resources(cpu=1, memory="1Gi"),
    image=image,
    secrets=[
        flyte.Secret(key="my_secret", as_env_var="MY_SECRET_KEY"),
    ]
)

When getting pod spec with kubectl describe command, we will directly see the secret value in ENVVAR, which is not secure:

Suggestion

We use webhook to inject secret into task pod. We should insert EnvVarSource instead of EnvVar value directly

貢獻者指南